Linux - SoftwareThis forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
If I want to limit the user can only run part of comamnd in /usr/bin , is it possible ? for example , if I want to limit the user can't use the command /usr/bin/wget , /usr/bin/gcc etc, what can I do ? thx
I haven't tried it on binaries, but if the files are on a file system that can use ACLs, you could remove read and execution access for certain users.
read through the man pages for the commands "getfacl" and "setfacl". You may need to install a acl package if it isn't by default.
I haven't tried it on binaries, but if the files are on a file system that can use ACLs, you could remove read and execution access for certain users.
read through the man pages for the commands "getfacl" and "setfacl". You may need to install a acl package if it isn't by default.
Ah, yes. My solution would wack all users.
Okay, Non-ACL solution.
Remove the permission as I provided.
Create a special group for users who get to run the command and add them to that group with execute permission. Not too elegant, I know, but you could come up with a script to automate the task I'm sure.
Hmm, does sudo let one restrict command access on basic commands?
Hmm, does sudo let one restrict command access on basic commands
aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi, /usr/bin/less
This prevents a person authorized to use sudo from using these programs which provide shell escapes.
entering the commands "!/bin/bash" would give the user full root access.
I don't know how good this protection is. For example, if they copied the command somewere else, could they execute it then?
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
